Small businesses and hackers: why size won't protect you

Ask a small business owner whether a hacker would bother with their company, and many will say no. That belief is common, and it is expensive. Attackers don't need you to be famous. They need one open door.

Who do hackers target?

Many attacks are not personal. A criminal uses tools that scan many businesses, try the same known weak points, and keep whatever works. They choose by ease, not by size.

That means a hacker doesn't need to know your company's name to find you. They only need to find an open door, and they can check thousands of doors without leaving their desk.

Why do so many owners believe they are safe?

The belief has three common sources. Nothing has happened yet, so the risk feels far away. Headlines tend to feature big names, so a small company can seem too ordinary to bother with. And protection feels expensive and technical, so it gets put off.

Each reason is understandable. None of them describes how automated attacks work.

How do automated attacks choose a victim?

They look for easy wins. The usual list is short: an outdated plugin, a password that is reused, an account with no two-step sign-in, an expired certificate, or an email domain that anyone can impersonate. The same list applies to a company with three people and a company with three hundred.

Attackers don't always need to break anything. An account that still uses an old password, or an email address that anyone can fake, is already open. The attacker only has to walk in.

Size is not on the list. A tool doesn't know how many people work in your office. It knows whether a door is open and whether a stolen password still works. If you want to see how the impersonation check works, the guide to email spoofing explains it in plain English.

Why is ransomware a bigger risk for small businesses?

Ransomware locks your files and demands money to unlock them. In the Verizon 2025 Data Breach Investigations Report, ransomware was part of 88% of breaches at small and medium businesses (SMBs). At large organizations, the figure was 39%.

The cost of an attack is not only the ransom. It includes the hours your team spends rebuilding, the work that stops while you do, and the effort to check what else may have been taken. Those costs remain even when you don't pay.

The report also says SMBs are less likely than large organizations to have up-to-date, easy-to-restore backups. A backup you have tested gives you a way to recover that doesn't depend on the attacker. Keep one copy somewhere separate from the computers that hold your files, and restore a sample file now and then to prove it works.

What happens to stolen passwords?

Infostealers are malware that copy saved logins from a computer and send them to criminals. Verizon's report looked at ransomware victims that were posted on extortion sites. It found that 54% of them had their domain appear in at least one infostealer log or marketplace posting. The figure is about the domain, not every single login. The report also says that using stolen credentials from infostealers is a key tactic of some ransomware operators.

So use a different password for every important account, store them in a password manager, and turn on two-step sign-in for email, banking and the admin panels of your website. If each account has its own password, a stolen one doesn't open the others.

How common is phishing for a small business?

Phishing and spoofing were the most reported crime type in the FBI's IC3 report for 2024, with 193,407 complaints. Phishing is a message that tricks you into giving up a password or a payment. Spoofing is faking the name or address of the sender.

The message doesn't have to be written for your company to reach your company. A fake invoice that arrives at the right time can cost real money. The fake invoice scam explains how to check a payment change, and how to tell if an email is a scam covers the warning signs.

Where should a small business start?

Start with the steps that close the most common doors, and do them in this order.

1. Turn on two-step sign-in. Begin with email, banking, the website's admin area and any shared tool that can send money or change the site.
2. Stop anyone from sending email as your domain. Check your email authentication: SPF, DKIM and DMARC. The plain-English guide explains each one.
3. Keep software and plugins updated. Start with the website. Outdated WordPress plugins covers the routine.
4. Back up and test a restore. Keep a copy somewhere separate from your daily computers, and restore one file to prove it works.
5. Check payment changes by phone. Before you pay a new bank account, call a number you already had. Never use the number in the message.
6. Keep the domain and the certificate renewing. Lapses are easy to avoid and easy to forget. Read what happens if your domain expires.

You don't need to finish all six in one day. Two or three done well close the most common doors.

Ward can help you see your business from outside. It checks your email authentication, the expiry of your domain and certificate, lookalike domains, blacklists and basic website settings. It is a fast way to see what anyone can see. It doesn't replace the steps above, and it can't check how your team handles a request on a busy Friday.

What if you think you have already been hit?

Act within hours, not days. Four steps come first.

• Change the passwords of the accounts that were affected, starting with email, and turn on two-step sign-in before you do anything else.
• Check for mail rules you didn't create, such as forwarding or hidden filters. Attackers sometimes add them to see replies without you noticing.
• Call your bank if money may have moved, and ask them to stop or recall the payment. Speed matters more than a perfect report.
• Tell the people who need to know, including customers whose data may be involved, and keep a written record of what happened and when.

If you are in the United States, you can report the incident to the FBI through ic3.gov. Reporting helps the investigators, and it gives you a record of what happened.

Is being small an advantage at all?

It can be. A small team can change a process in a day, and an owner can turn on two-step sign-in this afternoon. Use that speed.

The myth is not that small businesses are safe. The myth is that size protects them. It doesn't. The automated checks never ask how big you are, and the attackers who use them don't stop to ask.

The most expensive myth is the one that stops you from starting. Pick one step from the list today. Turning on two-step sign-in for your email takes a few minutes, and it closes one of the easiest doors to close.